BackConstruction 2.0 server
(Backdoor.Win32.BackConstructor.20)

by P23h

Compressed with ASPack

Released in June 1999

more versions


dropped file:
c:\WINDOWS\Cmctl32.exe  (only on Windows 98)
size: 177.664 bytes 

port: 5400, 5401, 5402 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Shell"  (only on Windows XP)
data: Cmctl32.exe 



tested on Windows 98 and Windows98
January 19, 2005

MegaSecurity